@selvajs/cli 4.7.4-beta.1 → 4.8.0-beta.11

package/src/deployment-package.js

@@ -0,0 +1,143 @@
+// The package.json a deployment directory gets. `create` writes it at scaffold
+// time and `migrate` rewrites an existing one onto it, so it lives here rather
+// than in either command — two copies drifted once already, and the pm2 pin is
+// exactly the field where a silent difference costs the most.
+
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/**
+ * pm2 is pinned exactly, not caret-ranged.
+ *
+ * pm2's CLI and its long-running daemon must be the same version. A range lets
+ * two deployments installed a week apart resolve differently, and the newer one
+ * silently adopts the daemon the older one started — the skew `ensurePm2InSync`
+ * has to detect and, in the daemon-is-newer direction, cannot repair (#118).
+ *
+ * Read from this package's own devDependencies rather than written here as a
+ * literal. Dependabot scans manifests, not source, so a literal is invisible to
+ * it — this pin sat on 5.4.3 while upstream reached 7.x, which is precisely the
+ * drift operators point at when they argue for distro packages instead.
+ * `checkPinIsExact` keeps the manifest entry from being loosened to a range.
+ */
+const PM2_VERSION = readPinnedPm2Version();
+
+function readPinnedPm2Version() {
+	const manifest = JSON.parse(
+		readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8')
+	);
+	const pinned = manifest.devDependencies?.pm2;
+	if (!pinned || !/^\d+\.\d+\.\d+$/.test(pinned)) {
+		throw new Error(
+			`@selvajs/cli devDependencies.pm2 must be an exact version, got ${JSON.stringify(pinned)}. ` +
+				`Every deployment this CLI scaffolds inherits it, and a range there lets two ` +
+				`installs resolve different pm2s that then fight over one daemon.`
+		);
+	}
+	return pinned;
+}
+
+const SCRIPTS = {
+	start: 'selva start',
+	stop: 'selva stop',
+	restart: 'selva restart',
+	logs: 'selva logs',
+	doctor: 'selva doctor',
+	update: 'selva update'
+};
+
+/**
+ * Packages a deployment carries. Providers are bundled into `@selvajs/selva`;
+ * the CLI is a dependency so `npm run start` resolves the `selva` bin locally
+ * instead of relying on a global install.
+ */
+const DEPENDENCIES = {
+	'@selvajs/cli': 'latest',
+	'@selvajs/selva': 'latest',
+	pm2: PM2_VERSION
+};
+
+/**
+ * npm `overrides` forced onto every deployment — security patches for
+ * transitive deps whose direct parent hasn't picked up the fix yet. Each entry
+ * is a temporary shim: remove it once the parent ships the fixed version on
+ * its own (the override then matches what would install anyway, so removal is
+ * cleanup, never urgent).
+ *
+ * js-yaml: pm2 <= 7.0.3 pins 4.3.0, which carries the quadratic-complexity
+ * DoS advisories (GHSA-5p4m-2wfm-xmqj and friends); the fix landed in 4.3.1.
+ * Drop when pm2's own js-yaml dependency reaches >= 4.3.1.
+ */
+export const OVERRIDES = {
+	'js-yaml': '^4.3.1'
+};
+
+/**
+ * Legacy `@selvajs/*` packages that a deployment may still list. Each was
+ * either renamed or folded into `@selvajs/selva`; `migrate` drops them and
+ * `doctor` reports them as layout drift.
+ */
+export const LEGACY_DEPENDENCIES = {
+	'@selvajs/runtime': 'the old runtime package',
+	'@selvajs/create': 'the old CLI package',
+	'@selvajs/platform': 'now bundled into @selvajs/selva',
+	'@selvajs/local-provider': 'now bundled into @selvajs/selva',
+	'@selvajs/supabase-provider': 'now bundled into @selvajs/selva',
+	'@selvajs/header-auth-provider': 'now bundled into @selvajs/selva'
+};
+
+/**
+ * Build the canonical deployment package.json.
+ *
+ * Dependencies are replaced wholesale rather than merged, so an operator's own
+ * additions are dropped. That is deliberate — a deployment directory is
+ * generated output, and anyone needing custom dependencies should depend on
+ * `@selvajs/selva` from their own project instead of editing this file.
+ *
+ * `engines` is the one exception, carried over when present: npm only enforces
+ * it under `engine-strict`, so an operator who pinned a Node floor did it
+ * deliberately, and dropping it removes a guard whose absence shows up only
+ * under real traffic (issue #176). Everything else a migration discards is
+ * listed by `diffPackageJson` before the operator confirms.
+ */
+export function buildDeploymentPackageJson({ name, version = '0.1.0', engines }) {
+	const pkg = {
+		name: sanitizePackageName(name),
+		version,
+		private: true,
+		type: 'module',
+		scripts: { ...SCRIPTS },
+		dependencies: { ...DEPENDENCIES },
+		overrides: { ...OVERRIDES }
+	};
+	if (engines && typeof engines === 'object') pkg.engines = { ...engines };
+	return pkg;
+}
+
+/**
+ * Top-level keys the canonical package.json defines. Anything outside this set
+ * that an operator added is dropped by `migrate` — `diffPackageJson` reports
+ * them so the loss is declared rather than discovered later.
+ */
+export const CANONICAL_FIELDS = new Set([
+	'name',
+	'version',
+	'private',
+	'type',
+	'scripts',
+	'dependencies',
+	'overrides',
+	'engines'
+]);
+
+export function sanitizePackageName(name) {
+	return (
+		String(name ?? '')
+			.toLowerCase()
+			.replace(/[^a-z0-9._-]+/g, '-')
+			.replace(/^[-._]+|[-._]+$/g, '') || 'selva-deployment'
+	);
+}
+
+export { DEPENDENCIES, SCRIPTS, PM2_VERSION };

package/src/env.js

@@ -2,7 +2,23 @@
 
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 
-// Parse a .env file into { key: value }. Preserves nothing else.
+// Old env name → its replacement, for keys renamed without changing meaning.
+// The server still reads each old name for one minor version and warns at
+// boot; keep this in sync with the server's list and drop an entry once the
+// server stops reading it.
+export const RENAMED_ENV_VARS = {
+	COMPUTE_DEFINITION_BYTE_CACHE_MB: 'COMPUTE_DEFINITION_CACHE_MB',
+	COMPUTE_RESPONSE_CACHE_MB: 'COMPUTE_SOLVE_CACHE_MB',
+	DEFINITION_CACHE_TTL_MS: 'REMOTE_DEFINITION_CACHE_TTL_MS',
+	MAX_SOLVE_DURATION_MS: 'COMPUTE_SOLVE_DEADLINE_MS'
+};
+
+// Deprecated vars whose replacement changes the VALUE too, so a simple key
+// rename can't migrate them — `selva migrate` leaves these alone rather than guessing.
+export const REPLACED_ENV_VARS = {
+	SELVA_FLAG_COMPUTE_DEBUG_VERBOSE: 'SELVA_FLAG_COMPUTE_DEBUG=verbose'
+};
+
 export function parseEnv(text) {
 	const out = {};
 	for (const rawLine of text.split(/\r?\n/)) {
@@ -28,7 +44,6 @@ export function readEnvFile(path) {
 	return parseEnv(readFileSync(path, 'utf8'));
 }
 
-// Merge values into template: preserve structure, rewrite in-place, append new keys.
 export function mergeEnv(template, values) {
 	const seen = new Set();
 	const lines = template.split(/\r?\n/);
@@ -69,7 +84,6 @@ export function mergeEnv(template, values) {
 		out.push(...appended);
 	}
 
-	// Ensure single trailing newline (shell append mishap guard).
 	while (out.length > 0 && out[out.length - 1] === '') out.pop();
 	return out.join('\n') + '\n';
 }
@@ -78,6 +92,46 @@ export function writeEnvFile(path, template, values) {
 	writeFileSync(path, mergeEnv(template, values), 'utf8');
 }
 
+/**
+ * Rewrite deprecated keys to their current names, in place. Only the key is
+ * touched — value, comments, ordering, and spacing survive.
+ *
+ * A key already present under its new name is left alone and its old line is
+ * dropped: the server resolves new-name-wins, so keeping both would preserve
+ * a line that does nothing.
+ *
+ * Returns `{ text, changes }`, `changes` being `[oldName, newName, 'renamed'
+ * | 'dropped']` per line acted on. Empty means the file was already current.
+ */
+export function renameEnvKeys(text, renames) {
+	const present = new Set(Object.keys(parseEnv(text)));
+	const changes = [];
+	const out = [];
+
+	for (const line of text.split(/\r?\n/)) {
+		const stripped = line.trim();
+		const eq = stripped.indexOf('=');
+		if (!stripped || stripped.startsWith('#') || eq === -1) {
+			out.push(line);
+			continue;
+		}
+		const key = stripped.slice(0, eq).trim();
+		const newName = renames[key];
+		if (!newName) {
+			out.push(line);
+			continue;
+		}
+		if (present.has(newName)) {
+			changes.push([key, newName, 'dropped']);
+			continue;
+		}
+		out.push(line.replace(key, newName));
+		changes.push([key, newName, 'renamed']);
+	}
+
+	return { text: out.join('\n'), changes };
+}
+
 function quoteIfNeeded(value) {
 	const s = String(value);
 	if (s === '') return '""';

package/src/node-range.js

@@ -0,0 +1,66 @@
+// Node version-range matching, used by `selva doctor` to check an installed
+// runtime and by the scaffolder to refuse a too-old shell before writing files.
+
+/**
+ * Narrow `engines.node` range check — `>=X`, `^`, `~`, `||`, and bare/x-ranges.
+ * Returns null when unparseable so a misread never reports a false failure.
+ *
+ * Mirrors `satisfiesRange` in @selvajs/server/ops. Duplicated because the CLI is
+ * dependency-free by design (it scaffolds the deployment that installs the
+ * runtime, so it cannot import from it).
+ */
+export function satisfiesNodeRange(version, range) {
+	const core = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(version).trim());
+	if (!core) return null;
+	const v = [Number(core[1]), Number(core[2]), Number(core[3])];
+
+	let anyParsed = false;
+	for (const alt of String(range).split('||')) {
+		const clauses = alt.trim().split(/\s+/).filter(Boolean);
+		if (!clauses.length) continue;
+
+		let all = true;
+		let parsed = true;
+		for (const clause of clauses) {
+			const m = /^(>=|<=|>|<|\^|~|=)?\s*v?(\d+)(?:\.(\d+|x|\*))?(?:\.(\d+|x|\*))?/.exec(clause);
+			if (!m) {
+				parsed = false;
+				break;
+			}
+			const op = m[1] ?? '=';
+			const num = (s) => (s == null || s === 'x' || s === '*' ? 0 : Number(s));
+			const t = [Number(m[2]), num(m[3]), num(m[4])];
+			let cmp = 0;
+			for (let i = 0; i < 3; i++) {
+				if (v[i] > t[i]) {
+					cmp = 1;
+					break;
+				}
+				if (v[i] < t[i]) {
+					cmp = -1;
+					break;
+				}
+			}
+			let ok;
+			if (op === '>=') ok = cmp >= 0;
+			else if (op === '>') ok = cmp > 0;
+			else if (op === '<=') ok = cmp <= 0;
+			else if (op === '<') ok = cmp < 0;
+			else if (op === '^') ok = cmp >= 0 && v[0] === t[0];
+			else if (op === '~') ok = cmp >= 0 && v[0] === t[0] && v[1] === t[1];
+			else
+				ok =
+					v[0] === t[0] &&
+					(m[3] == null || m[3] === 'x' || m[3] === '*' || v[1] === t[1]) &&
+					(m[4] == null || m[4] === 'x' || m[4] === '*' || v[2] === t[2]);
+			if (!ok) {
+				all = false;
+				break;
+			}
+		}
+		if (!parsed) continue;
+		anyParsed = true;
+		if (all) return true;
+	}
+	return anyParsed ? false : null;
+}

package/src/paths.js

@@ -1,9 +1,72 @@
-import { existsSync, readdirSync } from 'node:fs';
-import { resolve, join } from 'node:path';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { resolve, join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-// A deployment directory must contain an .env and an ecosystem.config.cjs.
-// Anything else (selva.config.js, node_modules) is "should be there" but the
-// CLI doesn't require it — `selva init` is allowed to fix a partial install.
+/**
+ * The Node floor Selva requires, read from this CLI's own `engines.node`.
+ *
+ * Never hardcode it: the CLI, runtime, and server all declare the same range in
+ * package.json, and a copy in code silently keeps enforcing the old floor after
+ * a bump. Falls back to null (skip the check) rather than guessing a number —
+ * refusing to scaffold on a wrong guess is worse than not checking.
+ */
+export function requiredNodeRange() {
+	try {
+		const here = dirname(fileURLToPath(import.meta.url));
+		const pkg = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8'));
+		const range = pkg.engines?.node;
+		return typeof range === 'string' ? range : null;
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * This CLI's own version, written into `.selva-version` so a later `selva
+ * migrate` can tell which scaffold layout it is looking at.
+ *
+ * Read from package.json for the same reason as `requiredNodeRange`: a literal
+ * in code stops tracking the release the moment someone forgets to bump it, and
+ * the marker's whole job is to be accurate about which CLI wrote the directory.
+ */
+export function scaffoldVersion() {
+	try {
+		const here = dirname(fileURLToPath(import.meta.url));
+		const pkg = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8'));
+		return typeof pkg.version === 'string' ? pkg.version : '0.0.0';
+	} catch {
+		return '0.0.0';
+	}
+}
+
+/**
+ * A scaffolding template shipped inside the installed runtime. The CLI cannot
+ * import from `@selvajs/selva` — it is what installs it — so it reads the files
+ * out of node_modules after install.
+ */
+export function runtimeTemplatePath(dir, name) {
+	return join(dir, 'node_modules', '@selvajs', 'selva', 'templates', name);
+}
+
+/**
+ * The `.env` template to merge operator values into: the runtime's `.env.example`
+ * when installed, otherwise the deployment's own `.env` so its comments and
+ * ordering survive a rewrite.
+ *
+ * Returns `''` when neither exists rather than throwing — `mergeEnv` appends
+ * every value to an empty template, so the operator gets a usable file instead
+ * of an ENOENT from a command that was only asked to change one key.
+ */
+export function readEnvTemplate(dir) {
+	const template = runtimeTemplatePath(dir, '.env.example');
+	if (existsSync(template)) return readFileSync(template, 'utf8');
+	const env = join(dir, '.env');
+	if (existsSync(env)) return readFileSync(env, 'utf8');
+	return '';
+}
+
+// Either .env or ecosystem.config.cjs is enough — selva.config.js and
+// node_modules are expected too, but init should still fix a partial install.
 export function isDeploymentDir(dir) {
 	return existsSync(join(dir, '.env')) || existsSync(join(dir, 'ecosystem.config.cjs'));
 }

package/src/prompts.js

@@ -18,9 +18,7 @@ export function collectConfigFromEnv(env = process.env) {
 		'local',
 		'SELVA_AUTH_PROVIDER'
 	);
-	// Default data/storage to auth — matches the prompt's "use same provider
-	// for all three" default. Header-auth has no data layer, so it falls
-	// through to local unless explicitly overridden.
+	// Header-auth has no data layer, so it falls through to local unless overridden.
 	const dataDefault = auth === 'header' ? 'local' : auth;
 	const data = pick(
 		env.SELVA_DATA_PROVIDER,
@@ -72,7 +70,6 @@ export function collectConfigFromEnv(env = process.env) {
 			values.HEADER_AUTH_DISPLAY_NAME_HEADER = env.HEADER_AUTH_DISPLAY_NAME_HEADER;
 	}
 
-	// ── Bootstrap admin ──────────────────────────────────────────────────
 	const adminRequired = auth === 'header' || tenancy === 'multi';
 	const adminEmail = env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL || '';
 	if (adminRequired && !adminEmail) {
@@ -127,15 +124,11 @@ function requireEnv(env, name) {
 	return v;
 }
 
-// Run full interactive prompt sequence; return env vars. Caller decides merge vs fresh.
-// `defaults` pre-populates prompts (cheap re-run).
 export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 	const isInit = mode === 'init';
 
 	p.intro(pc.bgCyan(pc.black(isInit ? ' selva init ' : ' Selva — new deployment ')));
 
-	// Brand prompts (SELVA_BRAND_NAME / COPYRIGHT_NAME / TAGLINE / DESCRIPTION)
-
 	const tenancy = await p.select({
 		message: 'Tenancy mode',
 		initialValue: defaults.SELVA_TENANCY ?? 'single',
@@ -169,7 +162,6 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 	});
 	cancelOn(auth);
 
-	// Header-auth: auth-only; user must pick separate data/storage backend.
 	let data;
 	let storage;
 	if (auth === 'header') {
@@ -197,7 +189,6 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 		cancelOn(storageChoice);
 		storage = storageChoice;
 	} else {
-		// Operators usually want same backend for all three; ask once, default the others.
 		const mixProviders = await p.confirm({
 			message: `Use ${pc.cyan(auth)} for data and storage too?`,
 			initialValue: pickSameProviderDefault(defaults, auth)
@@ -281,7 +272,6 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 	}
 
 	if (auth === 'header') {
-		// HEADER_AUTH_DATA_DIR: ask only if data provider isn't local (fallback available).
 		if (data !== 'local') {
 			const dataDir = await p.text({
 				message: 'HEADER_AUTH_DATA_DIR — directory for header-allowlist.json',
@@ -330,7 +320,7 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 			providerValues.HEADER_AUTH_DISPLAY_NAME_HEADER = stringValue(display);
 		}
 
-		// Header-auth: default to loopback (not enforced; Docker networks may override).
+		// Not enforced — a Docker network can still route to the container on another host.
 		const bindLoopback = await p.confirm({
 			message: 'Bind the app to 127.0.0.1 only? (recommended for header-auth)',
 			initialValue: !defaults.HOST || defaults.HOST === '127.0.0.1' || defaults.HOST === 'localhost'
@@ -339,7 +329,6 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 		providerValues.HOST = bindLoopback ? '127.0.0.1' : stringValue(defaults.HOST);
 	}
 
-	// Bootstrap admin (checked only while no admin exists; safe to leave set).
 	if (auth === 'header') {
 		p.note(
 			[
@@ -494,10 +483,11 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 	return values;
 }
 
-// Init: default to "same provider" only if current .env already shows that.
 function pickSameProviderDefault(defaults, auth) {
 	const data = defaults.SELVA_DATA_PROVIDER ?? auth;
 	const storage = defaults.SELVA_STORAGE_PROVIDER ?? auth;
+	// No existing defaults means a fresh `create`, not a re-prompted `init` — default to
+	// "same provider for all three" since there's nothing yet to disagree with auth.
 	if (!defaults.SELVA_DATA_PROVIDER && !defaults.SELVA_STORAGE_PROVIDER) return true;
 	return data === auth && storage === auth;
 }
@@ -527,5 +517,3 @@ function headerAuthSecurityWarning() {
 		pc.dim('See packages/providers/header-auth/README.md for the full deployment checklist.')
 	].join('\n');
 }
-
-export { p as prompts, pc as colors };

package/bin/create.js

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-import { runCreate } from '../src/commands/create.js';
-
-runCreate(process.argv.slice(2)).catch((err) => {
-	console.error(err instanceof Error ? err.message : err);
-	process.exit(1);
-});